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EXAMINER'S AMENDMENT 

An examiner's amendment to the record appears below. Should the changes 
and/or additions be unacceptable to applicant, an amendment may be filed as provided 
by 37 CFR 1 .312. To ensure consideration of such an amendment, it MUST be 
submitted no later than the payment of the issue fee. 

Authorization for this examiner's amendment was given in a telephone interview 
with Dan Layden (60,921) on 11/26/2008. 

The application has been amended as follows: 

1 . (Currently Amended) A method of monitoring a packet-switched network using traffic 
logs, comprising: 

[[(a)]] creating a histogram file associated with one of a node and a link within the 
packet- switched network; 

[[(b)]] at a first location within the packet-switched network, generating a traffic log 
specific to a particular packet of a plurality of packets based upon detection of a content 
of the packet, the traffic log containing a plurality of values detected within the packet 
comprising a time, wherein the time is time of the traffic log was created, a network 
entry point of the packet, a turn node , wherein the turn node is node number of the 
highest level in the packet-switched network through which the packet passed , a 
network exit point of the packet, and a packet state, wherein the packet state includes a 
congested indication; 
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[[(c)]] transferring the traffic log from the first location to a second location; 

[[(d)]] storing the traffic log generated by the network at the second location; 

[[(e)]] analyzing the stored traffic log to determine the time of creation of the 
traffic log and one or more nodes of a path traversed by the packet through the packet 
switched network from the network entry point to the network exit point; [[and]] 

creating a histogram file by reading plurality of values in the traffic log; the 
histogram file is representative of the number of packets of several states and a total 
number of packets that pass through a given node over a predetermined time period; 

[[(f)]] updating the histogram file according to at le ast the time of creation of the 
traffic log, the packet state, the network entry point and the network exit point of each 
packet of said plurality of packets; wherein the histogram file displays network 
conditions in near real-time enabling the detection and correction of network overloads 
and congestion at one of a network node and a network node link before network 
customers are affected. 

14. (Currently Amended) A method of monitoring packet traffic through a node of a 
packet-switched network using traffic logs, comprising: 

(a) cr e at i ng a h i stogram f ile for at le ast on e nod e i n th e n e twork; 

[[(b)]] generating a traffic log specific to a particular packet based upon detection 
of a content of the packet at a first location within the network based upon detection of 
the content of a packet of a plurality of packets , the traffic log containing a plurality of 
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values being read from the packet, the plurality of values including a time, wherein the 
time is time of the traffic log was created, a turn node, wherein the turn node is node 
number of the highest level in the packet-switched network through which the packet 
passed, a network entry point of the packet, a network exit point of the packet, and a 
packet state, wherein the packet state includes a congested state which is specified by 
the contents of the package; 

[[(c)]] transferring the traffic log from the first location to a second location; 

[[(d)]] storing the traffic log generated by the network at the second location; 

[[(e)]] analyzing the stored traffic log to determine the time of creation of the 
traffic log and one or more nodes of a path traversed by the packet through the packet 
switched network from the network entry and exit points of the packet; 

[[(f)]] determining a network path between the entry and exit points of the packet; 

[[(g)]] determining whether the node falls along the network path; [[and]] 

creating a histogram file by reading plurality of values in the traffic log; the 
histogram file is representative of the number of packets of several states and a total 
number of packets that pass through a given node over a predetermined time period; 

[[(h)]] updating the histogram file using at le ast a the time of creation of the traffic 
log.! and at le ast the packet state , the network entry point and the network exit point of 
each packet of said plurality of packets; wh e n th e nod e fa ll s a l ong th e n e twork path , 
wherein the histogram file is displays network conditions in near real-time enabling the 



Application/Control Number: 09/695,402 Page 5 

Art Unit: 2452 

detection and correction of network overloads and congestion at one of a network node 
and a network node link before network customers are affected. 



25. (Currently Amended) A method of monitoring packet traffic passing through a link 

connecting two nodes of a packet-switched network using traffic logs, comprising: 

(a) cr e at i ng a h i stogram f ile for at le ast on e li nk i n th e n e twork; 

[[(b)]] generating a traffic log specific to a particular packet based upon detection 
of a content of the packet at a first location within the network based upon detection of 
the contents of a packet of a plurality of packets , the traffic log containing a plurality of 
values detected within the packet, the plurality of values being read from the packet 
including a time, wherein the time is time of the traffic log was created, a turn node, 
wherein the turn node is node number of the highest level in the packet-switched 
network through which the packet passed, a network entry point of the packet, a 
network exit point of the packet, and a packet state, wherein the packet state includes a 
congested state which is specified by the content of the packet; 

[[(c)]] transferring the traffic log from the first location to a second location; 

[[(d)]] storing the traffic log generated by the network; 
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[[(e)]] analyzing the traffic log to determine [[a]]the time of creation of the traffic 
log and one or more nodes of a path traversed by the packet through the packet 
switched network from the network entry and exit points of the packet; 

[[(f)]] determining a network path between the entry and exit points; 

[[(g)]] determining whether the link falls along the network path; 

[[(h)]] determining a number of bytes carried by the packet associated with the 
traffic log; [[and]] 

creating a histogram file by reading the plurality of values in the traffic log; the 
histogram file is representative of the number of packets of several states and a total 
number of packets that pass through a given node over a predetermined time period; 

[[(i)]] updating the histogram file using at le ast the time of creation of the traffic 
log, the packet state, and the number of bytes when the link falls along the network 
path, wherein the histogram file is utilized to monitor network conditions in near real- 
time enabling the detection and correction of network overloads and congestion at one 
of a network node and a network node link before network customers are affected. 

36. (Currently Amended) A method of monitoring the operations of a packet- 
switched network, the method comprising: [[,11 

the packet-switched network automatically generating a traffic log specific to a 
particular packet based upon detection of a content of [[the]]each packet of a plurality of 
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packets, when a packet enters or exits the network by detecting values from the packet, 
th e m e thod compr i s i ng: the traffic log including plurality of values: the plurality of values 
being read from the packet including a time, wherein the time is time of the traffic log 
was created, a turn node, wherein the turn node is node number of the highest level in 
the packet-switched network through which the packet passed, a network entry point of 
the packet, a network exit point of the packet, and a packet state, wherein the packet 
state includes a congested indication: 

creating a histogram file by reading the plurality of values in the traffic log; the 
histogram file is representative of the number of packets of several states and a total 
number of packets that pass through a given node over a predetermined time period: 

[[(a)]] detecting when a new traffic log is available at a network control center; 

[[(b)]] downloading the new traffic log to a server computer that maintains a 
plurality of histogram files; 

[[(c)]] updating at least one histogram file of the server computer using 
information available from the new traffic log by analyzing the new traffic log to 
determine on e or mor e plurality of values detected from the packet that are stored by 
the new traffic log that are relevant to the at least one updated histogram, the on e or 
mere plurality of values including the time creation of the new traffic log, a packet state, 
wherein the packet includes a traffic state indication of at least one of the following data 
elements: an "OK" state, an "illegal" state, a "congested" state and an "error" state, the 
network entry point and the network exit point of each packet of said plurality of packets; 

[[(d)]] deleting the new traffic log; and 
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[[(e)]] making the updat e d at least one updated histogram file available to a client 
computer from the server computer, wherein the histogram file is utilized to monitor 
network conditions in near real-time enabling the detection and correction of network 
overloads and congestion at one of a network node and a network node link before 
network customers are affected. 



43. (Currently Amended) A method of analyzing the performance of a packet-switched 
network where packets traverse multiple networks, the method comprising: 

the packet-switched network automatically generating a traffic log specific to a 
particular packet based upon detection of a content of the packet of a plurality of 
packets, each time a packet exits the packet-switched network, e ach traff i c l og i nc l ud i ng 
at le ast a t i m e th e traff i c l og was cr e at e d, th e addr e ss e s of th e pack e t s e nd e r and 
pack e t r e c i p ie nt, and th e e ntry and e x i t pack e t - sw i tch e d n e twork nod e s, th e m e thod 
compr i s i ng th e st e ps of: the traffic log including plurality of values: the plurality of values 
being read from the packet including a time, wherein the time is time of the traffic log 
was created, a turn node, wherein the turn node is node number of the highest level in 
the packet-switched network through which the packet passed, a network entry point of 
the packet, a network exit point of the packet, and a packet state, wherein the packet 
state includes a congested indication: 
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[[(a)]] collecting at a centralized location a plurality of traffic logs from the packet- 
switched network, with each traffic log containing [[information]] the plurality of values 
relevant to a different packet that has exited the packet-switched network; 

[[(b)]] analyzing each of the plurality of traffic logs to determine i nformat i on the 
plurality of values about each of the plurality of packets that have exited the packet- 
switched network; and 

[[(c)]] automatically generating a plurality of histograms[[,]] by reading the plurality 
of values in the plurality of traffic logs, wherein each histogram is representative of the 
number of packets of several states and a total number of packets that pass through a 
given node over a predetermined time period; each histogram being based on 
information gleaned from the plurality of traffic logs about the packets that have exited 
the packet-switched network, wherein each histogram is utilized to monitor network 
conditions in near real-time enabling the detection and correction of network overloads 
and congestion at one of a network node and a network node link before network 
customers are affected. 

49. (Currently Amended) A system for monitoring a packet-switched network that 
automatically generates traffic logs, comprising: 

[[(a)]] a network control center at which the traffic logs are collected, each traffic 
log being specific to a particular packet based upon detection of a content of the packet 
and containing a plurality of values detected within a packet including a time, wherein 
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the time is time of the traffic log was created, a turn node, wherein the turn node is node 
number of the highest level in the packet-switched network through which the packet 
passed, a network entry point and a network exit point and a packet state, wherein the 
packet state includes a congested state which is specified by the content of the packet; 
and 

[[(b)]] a computer operable to : 

[[(i)]] create a histogram file[[,11 bv reading the plurality of values in the 
traffic log; the histogram file is representative of the number of packets of several 
states and a total number of packets that pass through a given node over a 
predetermined time period: 

[[(ii)]] store a traffic log generated by the network, 

[[(iii)]] analyze the traffic log to determine the time of creation of the traffic 
log and the network entry and exit points of a the associated packet, and 

[[(iv)]] update the histogram file using at le ast the time of creation of the 
traffic log, at le ast the packet state, and at le ast on e of the entry and exit points of 
the packet, wherein the histogram file is utilized to monitor network conditions in 
near real-time enabling the detection and correction of network overloads and 
congestion at one of a network node and a network node link before network 
customers are affected. 
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60. (Currently Amended) A system for monitoring packet traffic through a node of a 
packet-switched network that automatically generates plurality traffic logs, comprising: 

[[(a)]] a server connected to a network control center; and 

[[(b)]] a client connected to the server, wherein the server is operable to [[(i)]] 

create a histogram file for at least one node in the network by reading 
plurality of values in each traffic log of the plurality traffic logs, the histogram file 
is representative of the number of packets of several states and a total number of 
packets that pass through a given node over a predetermined time period: 17 ,11 

[[(ii)]]store [[a]] the traffic log specific to a particular packet based upon 
detection of a content of the packet and generated by the network that contains a 
plurality of values detected within a packet, the plurality of values being read from 
the packet including a time, wherein the time is time of the traffic log was created, 
a turn node, wherein the turn node is node number of the highest level in the 
packet-switched network through which the packet passed, a packet state, 
wherein the packet state includes a congested state which is specified by the 
content of the packet[[,]] ; 

[[(iii)]] analyze the traffic log to determine [[a]] the time of creation of the 
traffic log and the network entry and exit points of the packet, [[(iv)]] determine a 
network path between the entry and exit points, [[(v)]] determine whether the 
node falls along the network path[[,]]; and 
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[[(vi)]] update the histogram file using at le ast the time of creation of the 
traffic log [[and]L the packet state when the node falls along the network path, the 
entry and exit points of the packet, wherein the histogram file is utilized to 
monitor network conditions in near real- time enabling the detection and 
correction of network overloads and congestion at one of a network node and a 
network node link before network customers are affected. 



69. (Currently Amended) A system for monitoring packet traffic passing through a link 
connecting two nodes of a packet-switched network that automatically generates 
plurality of traffic logs, comprising: 

[[(a)]] a server; and 

[[(b)]] a client connected to the server, wherein the server is programmed to : 

(i) create a histogram file for at least one link in the network by reading 
plurality of values in each traffic log of the plurality traffic logs, the histogram file 
is representative of the number of packets of several states and a total number of 
packets that pass through a given node over a predetermined time period: 17 ,11 

[[(ii)]] store [[a]] the plurality of traffic logs; each traffic log of the plurality of 
traffic logs specific to a particular packet based upon detection of a content of the 
packet and generated by the network that contains a plurality of values being 
read from within a packet including : a time, wherein the time is time of the traffic 
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log was created, a turn node, wherein the turn node is node number of the 
highest level in the packet-switched network through which the packet passed, a 
network entry point, a network exit point, a packet state, wherein the packet state 
includes a congestion state which is specified by the content of the packet[[,]]; 

[[(iii)]] analyze the traffic log to determine [[a]] the time of creation of the 
traffic log and the network entry and exit points of the packet, (iv) determine a 
network path between the entry and exit points, [[(v)]] determine whether the link 
falls along the network path, [[(vi]]) analyze the traffic log to determine 
the number of bytes carried by the packet associated with the traffic log[[,]]i and 

(vii) update the histogram file using at le ast the time of creation of the 
traffic log, the packet state, [[and]] the number of bytes when the link falls along 
the network path, the entry and exit points of the packet, wherein the histogram 
file is utilized to monitor network conditions in near real-time enabling the 
detection and correction of network overloads and congestion at one of a 
network node and a network node link before network customers are affected. 

78. (Currently Amended) A system for monitoring the operations of a packet-switched 
network, the network automatically generating a traffic log when a packet enters or exits 
the network, the system comprising: 

a server, in communication with a network control center, for_ 
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create a histogram file for at least one link in the network by reading 
plurality of values in the traffic log, the histogram file is representative of the 
number of packets of several states and a total number of packets that pass 
through a given node over a predetermined time period: 

detecting when a new traffic log specific to a particular packet based upon 
detection of a content of the packet is available at the network control center, the 
new traffic log contains a plurality of values being read from within a packet 
including: a time, wherein the time is time of the traffic log was created, a turn 
node, wherein the turn node is node number of the highest level in the packet- 
switched network through which the packet passed, a network entry point, a 
network exit point, a packet state, wherein the packet state includes a congestion 
state which is specified by the content of the packet: 

[[for]] downloading the new traffic log: 

[[for]] updating at least one histogram file using information available from 
the new traffic log by analyzing the traffic log to determine on e or mor e values 
being detected and read from the content of the packet, wherein the on e or mor e 
values include a packet state, wherein the packet state includes a congestion 
state specified by the content of the packet , the time of creation of the traffic log, 
the entry and exit points of the packet, and wherein the at le ast on e histogram file 
is utilized to monitor network conditions in near real-time enabling the detection 
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and correction of network overloads and congestion at one of a network node 
and a network node link before network customers are affected; and ; 

a client computer for displaying the histogram. 

84. (Currently Amended) A system for analyzing the performance of a packet-switched 
network where packets traverse multiple networks , the system comprising: 

the network automatically generating a traffic log specific to a particular packet 
based upon detection of a content of the packet each time a packet enters or exits the 
packet-switched network, each traffic log including at le ast a time the traffic log was 
created, a turn node, wherein the turn node is node number of the highest level in the 
packet-switched network through which the packet passed, the address of [[the]] packet 
sender and packet recipient, and th e entry and exit packet-switched network nodes and 
a packet state, wherein the packet state includes a congested indication: , th e syst e m 
compr i s i ng 

[[(a)]] a traffic log database containing a plurality of traffic logs, each traffic log of 
the plurality containing a plurality of values detected in and read from the contents of the 
packet; and 

[[(b)]] a computer, operable to: 

download the plurality of traffic logs from the traffic log database[[, to]]; 
analyze each of the plurality of traffic logs to determine on e or mor e 
values detected from each of the packets , and to; 
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generate a pair of histograms by reading plurality of values in the plurality 
of traffic logs, the plurality of values including: a time the traffic log was created, a 
turn node, wherein the turn node is node number of the highest level in the 
packet-switched network through which the packet passed, the address of 
packet sender and packet recipient, entry and exit packet-switched network 
nodes and a packet state, wherein the packet state includes a congested 
indication and 

store plurality pairs of histograms, e ach pa i r of h i stograms b ei ng 
g e n e rat e d from i nformat i on g le an e d from th e p l ura li ty of traff i c l ogs about e ach of 
th e pack e ts, wherein at le ast the [[one]] pair of histograms is representative of 
packet traffic passing to and from a host connected to the packet-switched 
network, [[each]] the pair of histograms is utilized to monitor network conditions in 
near real-time enabling the detection and correction of network overloads and 
congestion at one of a packet-switched network node and a packet-switched 
network node link before network customers are affected. 

Reasons for Allowance 

The following is an examiner's statement of reasons for allowance: 
The prior art of record failed to teach the claim invention as claimed in claims 1-5,7- 
39,41-52 and 54-87. Specifically it failed to teach, generating a traffic log specific to a 
particular packet of a plurality of packets based upon detection of a content of the 
packet, the traffic log containing a plurality of values detected within the packet 



Application/Control Number: 09/695,402 Page 17 

Art Unit: 2452 

comprising a time, wherein the time is time of the traffic log was created, a network 
entry point of the packet, a turn node, wherein the turn node is node number of the 
highest level in the packet-switched network through which the packet passed, a 
network exit point of the packet, and a packet state, wherein the packet state includes a 
congested indication; analyzing the stored traffic log to determine the time of creation of 
the traffic log and one or more nodes of a path traversed by the packet through the 
packet switched network from the network entry point to the network exit point; creating 
a histogram file by reading plurality of values in the traffic log; the histogram file is 
representative of the number of packets of several states and a total number of packets 
that pass through a given node over a predetermined time period; updating the 
histogram file according to the time of creation of the traffic log, the packet state, the 
network entry point and the network exit point of each packet of said plurality of packets. 
The above limitations in combination with other limitations of claims 1-5,7-39,41-52 and 
54-87 enable claims' allowable. 

Any comments considered necessary by applicant must be submitted no later 
than the payment of the issue fee and, to avoid processing delays, should preferably 
accompany the issue fee. Such submissions should be clearly labeled "Comments on 
Statement of Reasons for Allowance." 



Conclusion 
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Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to DUYEN DOAN whose telephone number is (571)272- 
4226. The examiner can normally be reached on M-F 9:00-5:00. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, John Follansbee can be reached on 571 272 3964. The fax phone number 
for the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 

ID. D.I 

Examiner, Art Unit 2452 
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Primary Examiner, Art Unit 2452 



